librpc: Check for NULL pointer in value() in ntlmssp_AUTHENTICATE

This allows ndrdump --validate to avoid following a NULL pointer when re-pushing
a valid but unusual input.

It also avoids an issue if the Samba server code were to provide a response
without an EncryptedRandomSessionKey.

At this stage ntlmssp.idl is not used for this, instead the packets are
generated with msrpc_gen().

Found by Douglas Bagnall using Hongfuzz and the new fuzz_ndr_X
fuzzer.

Signed-off-by: Andrew Bartlett <abartlet@samba.org>
Reviewed-by: Douglas Bagnall <douglas.bagnall@catalyst.net.nz>
Autobuild-User(master): Andrew Bartlett <abartlet@samba.org>
Autobuild-Date(master): Wed Nov 20 06:06:29 UTC 2019 on sn-devel-184

diff --git a/librpc/idl/ntlmssp.idl b/librpc/idl/ntlmssp.idl
index f984b7b0b4caa753980212673fe4a1b6d6fff5a1..dd4c0b91640b1d9b785e42cc9d89eb864f7e168e 100644 (file)
--- a/librpc/idl/ntlmssp.idl
+++ b/librpc/idl/ntlmssp.idl
@@ -271,7 +271,7 @@ interface ntlmssp
                [value(ndr_ntlmssp_string_length(NegotiateFlags, Workstation))] uint16 WorkstationLen;
                [value(WorkstationLen)] uint16 WorkstationMaxLen;
                [relative] [subcontext(0),subcontext_size(WorkstationLen)] [flag(ndr_ntlmssp_negotiated_string_flags(r->NegotiateFlags))] string *Workstation;
-               [value(EncryptedRandomSessionKey->length)] uint16 EncryptedRandomSessionKeyLen;
+               [value(EncryptedRandomSessionKey == NULL ? 0 : EncryptedRandomSessionKey->length)] uint16 EncryptedRandomSessionKeyLen;
                [value(EncryptedRandomSessionKeyLen)] uint16 EncryptedRandomSessionKeyMaxLen;
                [relative] [subcontext(0),subcontext_size(EncryptedRandomSessionKeyLen)] DATA_BLOB *EncryptedRandomSessionKey;
                NEGOTIATE NegotiateFlags;

diff --git a/selftest/knownfail.d/ndrdump-NTLMSSP b/selftest/knownfail.d/ndrdump-NTLMSSP
deleted file mode 100644 (file)
index 40ff053..0000000
--- a/selftest/knownfail.d/ndrdump-NTLMSSP
+++ /dev/null
@@ -1 +0,0 @@
-samba.tests.blackbox.ndrdump.samba.tests.blackbox.ndrdump.NdrDumpTests.test_ndrdump_fuzzed_ntlmsssp_AUTHENTICATE_MESSAGE
\ No newline at end of file